Currently, when the app is configured with BTCEXP_BASIC_AUTH_PASSWORD, the Basic Auth popup is displayed as soon as the site loads.

In my opinion, the Basic Auth popup should only be displayed when the user attempts to GET/POST /rpc-terminal and/or GET /rpc-browser.

With the new behavior, then the explorer could remain public for general use, but require a password only when a user attempts to use the RPC functionality.